If its filling up quickly after you extend it, then something has written to it.
use this command (find /var -xdev -mmin -15 -ls)
this will files that have been modified within the last 15 minutes
check /var/spool/mail, /var/tmp and wherever your syslog files go (check /etc/syslog.conf)
files that show up with the find command, run through fuser and see if there are any active processes (syslogd will be expected).
if you find files in /var/spool/mail or /var/spool/mqueue that are too big to go through the mail system, you may want to remove them
ALWAYS check fuser results before removing files. removing an active file does not free the space until the process closes the file (usually by terminating)
Original Message:
Sent: 9/20/2022 2:51:00 AM
From: Haguma Honore
Subject: /var 100% full
Hello All,
Would you please advise me what should I do /var filesystem is getting full whenever I extend its size.
Regards
Honore